What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To secure SharePoint Online against ransomware, reduce the access an attacker can use, prepare tested recovery options, and respond to suspected encryption as an incident that may involve synced devices and Microsoft 365 identities—not just damaged files. If ransomware is suspected, stop synchronization from affected devices, contact your incident-response team through a channel believed to be secure, preserve evidence, and contain the compromise before restoring content.
This guide covers SharePoint Online and Microsoft 365. Organizations running SharePoint Server on-premises also need hardening and recovery guidance specific to their product version and environment.
As an Amazon Associate I earn from qualifying purchases.
Reduce the access an attacker could abuse
Require strong authentication and protect privileged accounts
Require multifactor authentication (MFA) or a stronger supported method for ordinary and administrator accounts. MFA reduces the impact of a stolen password by requiring another factor, but it is not a complete defense against token theft, session abuse, or malicious use of valid access.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteProtect administrator accounts carefully and limit standing privilege: people and accounts should have elevated access only when their duties require it. Include identity and tenant access in security reviews rather than treating SharePoint file permissions as the entire security boundary.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Limit broad write and delete access
Review sharing and permission inheritance across business-critical sites and libraries. Identify groups or users with broad ability to edit or delete content, then narrow those permissions where operationally possible. Revisit the configuration regularly so that broad access does not quietly return.
Keep useful records and know who can act
Monitor critical data locations and make relevant Microsoft 365, identity, and endpoint audit records accessible to the response team. Establish which logs exist, whether they are current, and how long they are retained; these details affect how well responders can reconstruct activity.
Before an incident, document who is authorized to contain accounts or devices and who can restore a library. Record which recovery features are enabled, their applicable retention limits, and which backup service the organization relies on. Exercise restores and validate both recovered data and the configuration needed to use it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Recognize when ransomware may be affecting a library
Microsoft identifies several possible signs of ransomware in SharePoint Online:
- Many library files have the same modified timestamp.
- Files fail to open.
- Ransom instructions appear in directories.
- File extensions have changed or been appended to.
These are indicators to investigate, not proof that the problem is confined to a SharePoint library. Ransomware may be running on an endpoint and changing files in a mapped SharePoint library or OneDrive connection; synchronization can then carry those changes to the cloud.
Contain the incident and preserve evidence
Stop affected synchronization
If ransomware is suspected in a synchronized library, promptly stop OneDrive synchronization on the affected device or disconnect the mapped library. This can limit further synchronized changes while the incident is assessed; it does not establish that the endpoint, account, or Microsoft 365 tenant is safe.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Bring in incident responders using secure communications
Notify your organization’s security or incident-response team through a channel believed to be secure. Microsoft Defender XDR’s Responding to ransomware attacks playbook says: “When you suspect you were or are currently under a ransomware attack, establish secure communications with your incident response team immediately.”
Contain while investigating
For an active or potentially wider compromise, containment and investigation should proceed in parallel where possible; quick containment buys responders time to understand the scope. Depending on the evidence and response plan, actions may include suspending compromised privileged accounts, stopping remote sessions, resetting credentials, and protecting backup systems. Do not treat account deletion or a broad shutdown as automatic first steps: preserve systems and forensic evidence, and follow the organization’s incident-response process.
Scope affected users, devices, applications, sites, and the initial activity window. Preserve the relevant endpoint, identity, and Microsoft 365 records so responders can investigate what happened and whether access remains compromised.
Rank #4
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Verify that the attacker has lost access before restoring
Restoring files while an attacker still has access can expose recovered content to further damage. Investigate identity and tenant access, contain active compromise, and confirm that unauthorized access has been removed before returning affected content to service. Microsoft’s incident guidance also calls for verifying backups and confirming there is no unauthorized Microsoft 365 tenant access before restoration.
Make the access review part of incident closure, not an assumption based on the files opening again. Record the security changes made and the evidence used to determine that restoration is safe.
Choose a recovery path that matches the damage
SharePoint Online offers several recovery mechanisms, but their availability and results depend on tenant settings, available file versions, the affected service, and the type of change. Recovery features restore content; they do not replace investigation or containment.
Best Value
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
| Recovery option | What it can do | Limits and checks |
|---|---|---|
| Version history | Restore an earlier file version when one is available. | Check the library’s current versioning settings and whether the needed version still exists. A 2021 Microsoft tenant-ransomware article described a minimum of 500 file versions by default, with the option to configure more; this older claim is not a universal statement about current tenant settings. |
| Recycle bins | Recover deleted items through the SharePoint recycle-bin flow. | Microsoft’s current SharePoint and OneDrive resiliency guidance describes 93 days of SharePoint recycle-bin retention. This is a retention window, not a guarantee that every overwritten or encrypted file can be recovered through the bins. |
| Files Restore | Return a SharePoint document library to a point in time within the previous 30 days, according to Microsoft’s current resiliency guidance. | The feature uses file versions, so reducing the available versions can reduce its effectiveness. Confirm the available restore points and expected result for the affected library. |
| Microsoft 365 Backup | Restore backed-up SharePoint data using selected restore points; Microsoft describes full site and file or folder restores. | Restore-point frequency determines the recovery point interval. Confirm the available points, restore scope, and administrative dependencies before relying on this service. |
| Microsoft support recovery | An administrator can contact Microsoft support if content cannot be restored after removal from the site collection recycle bin. | Microsoft’s ransomware-handling guidance describes a 14-day window for this route. Confirm current applicable support terms before relying on it. |
Compare backup and recovery plans before an incident
Microsoft 365 Backup or an independently managed backup service may be appropriate depending on recovery objectives. Do not assume third-party services provide equivalent performance or protection. Compare the details that determine whether a recovery plan will work under pressure:
- Scope: Can it restore an individual file, library, site, or a broader set of data?
- Restore points: How frequently are they created, how old can a usable point be, and what retention applies?
- Recovery: How quickly can restoration be completed, and can data be restored to its original or an alternate location?
- Administrative dependency: Which tenant administrators or service accounts are required to restore?
- Protection of backups: What safeguards apply if an attacker or malicious administrator tries to delete or alter backup data?
- Evidence of recoverability: Has the organization exercised a restore and verified the result?
Microsoft documentation describes built-in recovery capabilities and selected restore points, but does not provide a neutral head-to-head comparison of third-party services. Verify each service’s exact restore scope, retention, isolation, and terms rather than generalizing from a product category.
Quick Recap
Restore carefully and validate the result
- Choose a recovery point: Use the last appropriate point before the damaging changes, based on the investigation and the recovery mechanism available.
- Restore the required scope: Restore the affected files, folders, or library as appropriate. Record the selected point, affected locations, and what was restored.
- Check content: Confirm that restored files open and contain the expected data; verify representative files and important business-critical content.
- Check the service configuration: Validate relevant library settings and access permissions alongside the recovered data.
- Document follow-up: Record validation results, remaining issues, and security changes made during response.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
